Fallos del tipo CWE-354

120 resultados

Validação inadequada de valor de integridade

O sistema calcula ou recebe um valor de verificação de integridade (checksum, hash, assinatura) mas não valida corretamente se esse valor corresponde aos dados reais. Isso permite que um atacante modifique dados sem detecção, comprometendo a confiabilidade da informação transmitida ou armazenada.

Ejemplo

Uma API retorna um JSON com dados de usuário e inclui um MD5 dos dados para verificação. Se o código que consome a API nunca realmente compara o hash calculado com o hash recebido (ou faz a comparação de forma fraca), um intermediário pode alterar os dados e recalcular um hash falso que a validação deixa passar.

Cómo mitigar

Sempre validar que o valor de integridade recebido ou calculado corresponde exatamente aos dados verificados antes de usar esses dados. Use algoritmos criptográficos fortes (SHA-256 ou superior) e implemente a verificação em todas as camadas de processamento, não apenas em uma.

CVE-2022-45191MEDIUMAn issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pairEPSS 0.2%CVE-2025-11543CRITICALImproper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthEPSS 0.2%CVE-2026-75625CRITICALKraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification BypassEPSS 0.2%CVE-2026-40323HIGHSP1 V6 Recursion Circuit Row-Count Binding GapEPSS 0.2%CVE-2026-32148HIGHLockfile checksums not verified in Hex allows dependency integrity bypassEPSS 0.2%CVE-2025-25183LOWvLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cacheEPSS 0.2%CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%CVE-2026-82549MEDIUMLinux Foundation Magma SecurityModeComplete integrity checkEPSS 0.2%CVE-2026-16317HIGHSilent Drop of TLS 1.3 Encrypted Records in s2n-tlsEPSS 0.2%CVE-2024-51141HIGHAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe aEPSS 0.2%CVE-2026-50128MEDIUMMastodon: Spoofing of attribution domainsEPSS 0.2%CVE-2026-50021MEDIUMpnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldEPSS 0.2%CVE-2021-41206HIGHIncomplete validation of shapes in multiple TF opsEPSS 0.2%CVE-2024-56169MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintainEPSS 0.2%CVE-2026-48028MEDIUMMastodon: Removal of integrity-protected JSON entries from signed activitiesEPSS 0.2%CVE-2025-24148MEDIUMThis issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VEPSS 0.2%CVE-2026-32105CRITICALxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS modeEPSS 0.2%CVE-2023-28002MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versioEPSS 0.2%CVE-2025-11694HIGHRockwell Automation CompactLogix 5370 Controllers – Multiple VulnerabilitiesEPSS 0.2%CVE-2026-26275HIGHhttpsig-hyper has Improper Digest Verification that May Allow Message Integrity BypassEPSS 0.2%